First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-59235

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Access 2016	>= 16.0.0, < 16.0.5522.1000
Microsoft	Microsoft Access 2016 (32-bit edition)	>= 16.0.0, < 16.0.5522.1000
Microsoft	Microsoft Excel 2016	>= 16.0.0.0, < 16.0.5522.1000
Microsoft	Microsoft Office 2019	>= 19.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2021	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2024	>= 16.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC for Mac 2021	>= 16.0.1, < 16.102.25101223
Microsoft	Microsoft Office LTSC for Mac 2024	>= 16.0.0, < 16.102.25101223
Microsoft	Microsoft SharePoint Enterprise Server 2016	>= 16.0.0, < 16.0.5522.1000
Microsoft	Microsoft SharePoint Server 2019	>= 16.0.0, < 16.0.10417.20059
Microsoft	Office Online Server	>= 16.0.0.0, < 16.0.10417.20059

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59235Vendor Advisory

Timeline

Published: Oct 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-592367.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-592378.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-592387.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-59244.3The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2 CVE-2025-592405.5Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information CVE-2025-592417.8Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized atta CVE-2025-592427.8Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-592437.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-592446.5External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.CVE-2025-592459.8Microsoft SharePoint Online Elevation of Privilege Vulnerability CVE-2025-592469.8Azure Entra ID Elevation of Privilege Vulnerability CVE-2025-592479.8Azure PlayFab Elevation of Privilege Vulnerability

CVE-2025-59235: High severity, CVSS 7.1 | Vulnix